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FRAME ID: 4010 


(U) Module 4 

(TS//SI//NF) Access, Sharing, Dissemination, and Retention Under the BR and PR/TT 

FISC Orders 

(U) This module will enable you to: 

• (TS//SI//NF) Distinguish between the analysts authorized to query BR and PR/TT 
metadata and those authorized to view query results 

• (TS//SI//NF) Recognize the contact chaining restrictions for RAS-approved 
identifiers 

• (TS//SI//NF) Recognize what constitutes unique BR and PR/TT query results 

• (TS//SI//NF) Identify limitations that impact the access, sharing, dissemination, and 
retention of BR and PR/TT query results 

• (TS//SI//NF) Recognize the BR and PR/TT dissemination tracking requirement and 
the additional CT nexus requirement for U.S. person identifiers 
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( TS//S I //NF ) (OGC Attorney): During this part of our trip we will identify the limitations regarding access, sharing, disseminating, and retaining of BR and 
PR/TT query results. 

(U) This module will enable you to: 

• ( TS//S I //N F) Distinguish between the analysts authorized to query BR and PR/TT metadata and those authorized to view query results 

• ( TS//S I //NF ) Recognize the contact chaining restrictions for RAS-approved identifiers 

• ( TS//S I //NF ) Recognize what constitutes unique BR and PR/TT query results 

• ( TS//S I //NF ) Identify limitations that impact the access, sharing, dissemination, and retention of BR and PR/TT query results 

• ( TS//S I //NF ) Recognize the BR and PR/TT dissemination tracking requirement and the additional CT nexus requirement for U.S. person identifiers 

( TS//S I //NF ) If you are a technical person, you might be asking yourself if this information is directly applicable to you and your team. Compliance with the 
FISC Orders could be jeopardized by inadvertent or unintended changes in the infrastructure maintained by technical personnel. Therefore, an 
understanding of the requirements outlined in the Orders is important in the event that any technical support functions (data access, presentation, 
underlying system support - both hardware and software, etc.) cause changes to the support infrastructure that would bring NSA’s compliance with the BR 
and PR/TT Court Orders into question. 
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( TS//SI//NF ) BR and PR/TT Credentials - who can query, who can view results 



NEXT FRAME ID: 4025 



BACK FRAME ID: 4010 
ALT TAG: 
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( TS//S I //NF ) Access to BR and PR/TT raw 
metadata and query results is restricted to those 
who have the required training and appropriate 
credentials 



(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 



( TS//S I //NF ) (SV Character): Access to BR and PR/TT raw metadata and query results is restricted to those who have the required training and appropriate 
credentials. The Office of the Director of Compliance (ODOC) through the Signals Intelligence Directorate’s Office of Oversight and Compliance (SV) 
controls access to the BR and PR/TT FISA metadata, ensuring that only those who have completed all of the required training and have been granted the 
appropriate credentials are permitted to touch the metadata. 



( TS//S I //NF ) Within the analyst workforce, a distinction is made between individuals who are permittecO^iuei^h^lat^ncOhose who are permitted only 
to view the query results. Individuals who are authorized to query BR and PR/TT metadata sets have ^^^^^^^^^^^^Icredentials. Division level 
management within a production center determines when query permissions will be granted to analysts based on a mission need, not solely on completion 
of BR and PR/TT FISA T raining. Some technical personnel may also require query access, but their queries are for the purposes of data accuracy and 
integrity, not for target or intelligence analysis. Managers of technical personnel who require query permissions will make the determination in concert with 
their organization’s compliance office, usually either SV or TV (the Technology Directorate’s office of compliance). 
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(TS//SI//NF) How Do I Determine Who Has the Proper Credentials? 



NEXT FRAME ID: 4030 
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GRAPHIC/AV: 

(U //FOUO ) View of images 

pertinent to checking for credentials 



(U) Type 





and check credentials. 



( TS//S I //NF ) (SV Character): So, how do you determine if an analyst or technical colleague has t he approp riate credentials? a tool that can 

heh^o^hecl^omeon^lse’s credentials against your own. From your NSANet machine, type^H^H n y° ur web browser. This takes you to the 

Lookup Utility. Insert the sid of the analyst or technicahDemoi^ou^^woddna with and hit search, the formal accesses you 
share in common are displayed. From that you can determine if they hold the^^^^^^^^^^^^^^^^(:redentials. If the utility is not functioning for 
some reason, you should contact SV4 to verify the individual’s credentials before proceeding. 
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FRAME ID: 4030 


(U) Auditing and Access 



( TS//S I //NF ) The Court Orders require that when the metadata is queried for intelligence 
analysis purposes that an auditable record be generated. 



NEXT FRAME ID: 4040 



BACK FRAME ID: 4025 
ALT TAG: 



( TS//S I //NF ) The ^^^^audit log includes: 

• Query requests 

• User login 

• IP address 

• Date and time of the access 



GRAPHIC/AV: 

(U) Image of OGC Attorney, FIMC 
Character, and SV Character sitting at a 
table 



(TS//S I //NF) What is the EAR and how does it function as a compliance safeguard? 



( TS//S I //NF ) (SV Character): The BR and PR/TT Court Orders require tha^i^uditable record be generated whenever metadata is queried for intelligence 
analysis purposes. When thyg^BR and PR/TT metadata is queried in^^^^|an automatic audit log is generated to enable appropriate oversight of 
these Authorities. SV audits ^^^^^queries performed by both analysts and technical personnel and reviews the following on a periodic basis: 

• Query requests 

• User login 

• Internet Protocol (IP) address 

• Date and time of the access 



Comment [SLS1]: Not^o^udio recording, this 
is pronounced as a word^R||^3j|^ j 



-(-TS//SI//Nl^^jM^;haracter): While these audits are one way to verify that only RAS-approved identifiers are used as seeds to query the BR and PR/TT 

metadata, TOM the analytic tool used to query this metadata, employs an Emphatic Access Restriction (EAR) software to provide reasona ble Comment [SLS 2 ]: Note for audio recording, this 

assurance that only RAS-approved identifiers are queried by analysts. While the EAR is of great benefit for analysts, it should not lessen awareness and is pronounced as a woi-d “ear" (not as letters) 
attention to detail while using the NSA tools and applications associated with BR and PR/TT. We’ll discuss the EAR in greater detail later in this module. | 
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( TS//S I //NF ) Sourcing of BR and PR/TT Metadata Records 



NEXT FRAME ID: 4050 



BACK FRAME ID: 4030 
ALT TAG: 
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( TS//S I //NF ) Within NSA’s source systems of record, BR and PR/TT metadata records are 
tagged as to their origin, which allows for: 

• Determining if information is derived from the BR or PR/TT repository 

• Software and other management controls to function properly 



(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 



( TS//S I //NF ) (OGC Attorney): Another aspect of data access and governance is the requirement for the sourcing of BR and PR/TT metadata records. As we 
mentioned in Module 2, the metadata must carry unique markings, or tags. These tags allow the analyst to determine if a particular piece of information is 
derived from either the BR or PR/TT repository. In addition, these markings enable the EAR software and other management controls to function properly. 
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FRAME ID: 4050 


(U) Knowledge Cl 

1 (TS//SI//NF) Ide 


leek 1 

itify the individuals or groups below who are authorized to receive and view results of 
n BR and/or PR^^dat^please check all that apply). 

dividuals witl^^^^^H^^Hcredentials 
ACs with analysts with 

chnical personnelwith^^^B credentials 

ur office chief and oversight personnel by virtue of their positional responsibility 
>ne of the above 

at should you do before sharing the results of a B^ir PR/TT query with a co-worker 
reasonably believed to be associated with the^H? 
ad your e-mail to see if your co-worker asked yoTnor the information 
II one of the SOOs in the NSOC to find out if information about your target can be 
eased to your co-worker 

rify that the co-worker has the proper credentials to have access to BR and PR/TT 
Formation 

of the above 


NEXT FRAME ID: 4060 

BACK FRAME ID: 4040 
ALT TAG: 
GRAPHIC/AV: 


queries that contai 

a) In 

b) HI! 

c) Te 

d) Yc 

e) Nc 

2. (TS//SI//NF) Wh 
working on a targe 

a) Re 

b) Ce 
re 

c) Ve 
in 

d) Al 


(U) (SV Character): Let’s check in and make 


a few quick notes in our travel journal and see what we remember from this topic. 


ANSWERS: 

Question 1. (TS//SI/NF) Correct! a), b), and c) describe individuals and groups holding ^^^^^^^^^redentials. 

(TS//SI/NF) Incorrect. Positional authority does not supersede the requirement to have these specific credentials. Not all managers or SV personnel may 
require these credentials for their specific jobs. The correct answers are a), b), and c). 

Question 2. (TS//SI/NF) Correct! Before you share any BR or PR/TT query results with a co-worker, you must first verify that he or she has the proper 
credentials to have access to BR and PR/TT information. 

(TS//SI/NF) Incorrect, The answer is c). Before you share any BR or PR/TT query results with a co-worker, you must first verify that he or she has the 
proper credentials to have access to BR and PR/TT information. 
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Screen Number 
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Next 



NEXT FRAME ID: 4070 



BACK FRAME ID: 4050 



ALT TAG: 



GRAPHIC/AV: 

(U) Display and fade out the questions 
shown as an intro to the topics to be 
covered in this section. 



(U) Have RAS, will query? How? 

( TS//S I //NF ) How do I recognize BR and or PR/TT results, and what are "unique" results? 
(U) Once I have results, how do I handle them? Are there any restrictions? 



(U) For the transcript paragraph spoken by 
the Technical Character, consider using a 
creative treatment that shows the character 
for a brief period and then fades her out 

(perhaps a news bulletin or a postcard??). 

( TS//S I //NF ) (HMC Character): In this section of the module, we’ll cover how analysts query the BR and PR/TT metadata. In addition, we’ll go into detail on 
what constitutes BR and PR/TT results and how to tell if they are unique. Since BR and PR/TT unique results may only be shared with individuals who 
have the proper credentials, being able to identify unique BR and PR/TT query results will help you comply with the sharing and handling restrictions. 



( TS//S I //NF ) (Technical Character): While this section may appear to be more focused on analytic-specific tools, certain technical personnel also query 
these datasets to provide reasonable assurance of data integrity or to make the metadata usable for intelligence analysis. Therefore, technical personnel 
and their managers should also be aware of guidelines related to queries, handling instructions for query results, in any form, and the requirements related 
to sharing of unique query results, in any form. 
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Fiome Exit | Glossary | Back Next 

( TS//S I //NF ) How are Analyst Queries of the BR and PR/TT Metadata Conducted? 

(TS//SI//NF ) Queries of BR and PR/TT metadata are conducted through ^^^^|the user 
interface to^^^^^^As a default, queries are federated with data from other collection 
sources. 



PluatiO click 110x1 to ttio ruio cot you wiob 

to usn fm ^^^n^sinn You will than ha abl» 

to select ono or more oftlie underlying rules associated with 
that rule sot in thin way you will he better able to control 
which databases are searched by your query 
ir, in addition to SIOINT data, you wish to work with OCX! 
court-ordered Date Sources<l*ENItEOlOTNY|riaAOiy). check 
tho appropriate boxen below 
WAKNINU: SttCIAL HULLS AII'LYI 



□ SPCMA Mode 

□ l*fcNKJfcGlt>tKY Muilu 
MSAHK Mode 

Nor mol Mmln 



© 



At least one role must be selected 



V E FISABR Mode 

E FISABR 
E E012333 



( TS//S I //NF ) (FIMC CharacteU^)nce RAS approve^ai^dentifier can be used to query the BR and/or PR/TT metadata via authorized versions of 
the user interface When launching analysts with the appropriate BR or PR/TT credentials have the option to check a box iHhe; 

wish to in clude BR or PR/TT metadata in their queries. If an analyst checks the jFISABR Mode” or "P ENREGI STRY Mode” box when logging into 

■w 



perform a federated query. This means that in addition to either BR or PR/TT metadata 
additional collection authorities, depending on the analyst’s credentials. Therefore, when performing^ 
potentially receive results from all of the above collection sources. Users of more recent versions of 
the query, and pick and choose amongst the collection sources that they would like to query. 



'ill also query data collected under 
of the BR or PR/TT metadata, analysts will 
o have the option, however, to “unfederate” 




|omment [SLS3]: Note for audio recording, this 
should be pronounced as the word FISA then the 
letters B R, so simply “FISA B R” 



Comment [a4]: See Screenshot 1. 
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( TS//S I //NF ) How are Analyst Queries of the BR and PR/TT Metadata Conducted? 



NEXT FRAME ID: 4077 



BACK FRAME ID: 4070 



ALT TAG: 



GRAPHIC/AV: 

(U) Look at Annie’s notes and match 
transcript to screen shots. 



( TS//S I //NF ) (HMC Character): Once you are operating within the BR or PR/TT mode of remember that you may only use a RAS-approved 

identifier to query the metadata. A RAS-approved identifier that is used to initiate a query of BR or PR/TT metadata is referred to as a “seed” since it is 
being used to produce a “chain” of metadata contacts, known as contact chaining. 



employs the EAR software to provide reasonable assurance that only RAS-approved identifiers are queried by analysts. Before 
executing a query on an identifier, the EAR verifies that the identifier is RAS-approved. If an analyst attempts to query a non-RAS-approved identifier while 
still in BR or PR/TT query mode, the EAR will provide reasonable assurance that no results are returned for that query; this includes data not derived from 
BR or PR/TT. This query will, howe_ver i _be_reflected in SV’s auditing and a justification for the query attempt may be requested. If you are unsure whether 

Ito determine the identifier’s approval status. 



an identifier is RAS-approved, use I 
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(TS//SI//NF) Contact Chaining with BR and PR/TT metadata 



NEXT FRAME ID: 4080 



BACK FRAME ID: 4075 



ALT TAG: 



GRAPHIC/AV: 

(U) Image of OGC Attorney, FIMC 
Character, and SV Character sitting at a 
table 

(U) Look at ^^^|notes and match 
transcript to screen shots. 

( TS//S I //NF ) Create animation to explain 
the following: While the BR Order permits 
contact chaining for up to three hops, NSA 
has decided to limit contact chaining to only 
two hops away from the RAS-approved 
identifier without prior approval from your 
Division management to chain the third 
hop. Linder PR/TT, the FISC limits the 
number of hops for internet 
communications to only two, and the hop 
counter will not permit these FISC- 
mandated levels to be exceeded 



( TS//S I //NF ) (FIMC Character): Once the EAR verifies that the seed that the analyst has requested to query is RAS approved, it will allow the analyst to 
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“chain” on that identifier. In the BR and PR/TT Orders, the FISC sets limits on how e xtensive this chaining may be. We refer to this as the numb er of hops 
from a RAS-approved identifier. For example, let’s say your target calls an associate associate then calls several^^^Hln 

this example it is one hop from your RAS-approvedidentifier to the associate and another hop from the associate to a recruit. In other words, the associate 
is a “first hop” contact of your target, and the ^^^|are “second hop” contacts. 



( TS//S I //NF ) (OGC Attorney): While the BR Order permits contact chaining for up to three hops, NSA has decided to limit contact chaining to on ly two hop; 
away from the RAS-approved identifier without prior approval from your Division management to chain the third hop. Under PR/TT, the FISC limits the 
number of hops for internet communications to only two. Technical controls will not permit these FISC-mandated hop levels to be exceeded. 

( TS//S I //NF ) (PIMC Character): If another RAS-approved identifier is encountered within the authorized number of hops from the previous RAS-approved 
identifier, the number of hops resets to allow a contact chain to be generated out the authorized number of hops from the newly encountered RAS- 
approved identifier. 



Comment [a5]: We can probably use some of the 
existing screenshots we made to also illustrate the 
hops. 
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( TS//SI//NF ) What is a Query Result and how do I know if it is a BR or PR/TT Query 
Result? 



NEXT FRAME ID: 4090 



( TS//S I //NF ) Query Result: Queries produce results in the form of a contact chain 
presented in^^Jormat; each chain is comprised of individual contacts derived from data 

returned from the multiple collection sources queried. Each contact/line within a chain 

represents an individual result. ( comment [a6]: This is illustrated by screenshot 2 



BACK FRAME ID: 4077 



ALT TAG: 



GRAPHIC/ AV: 

(U) Look at notes and match 

transcript to screen shots. 



( TS//S I //NF ) (HMC Character): When you query a RAS-approved identifier in BR or PR/TT modes, ^^^^^vill return a ^|file, usually 

referred to as a chain, which is made up of the individual first hop contacts of the seed. Bearing in mind the hop restrictions just discussed, analysts may do 

further chaining on those contacts. Each of these contacts, or line within the chain, represents an individual result . Remember, unless you choose to | comment [a 7 ]: This is illustrated by screenshot 2 j 
unfederate your query as we described earlier, these results may have been obtained under a variety of collection authorities. 



( TS//S I //NF ) It is possible to determine the collection source or sources of each result within the chain by examining the Producer Designator Digraph 
(PDDG)/SIGINT Activity Designator (SIGAD) and collection source(s) at the end of the line. 



( TS//S I //NF ) If at least one source of a result is BR or PR/TT metadata, the classification at the beginning of the line will contain the ph rases FISABR or 
PR/TT, respectively. In addition, in the^ourcejnformation^Uhe^nd_oHhe_line J Jhe_SIGAD data can be 

recognized by SIGADs beginning with 

after October foun r a 

comprehensive listing of all the BR and PR/TT SIGADs as well as information on PR/TT data collected prior to November of 2009, contact your 



Comment [SLS8]: Note for audio recording, this 
should be pronounced as a word “SIGAD” (not 
spelled out in letters as S I G A D) 



Comment [a9]: I really think we need some 
For PR/TT, data ! pictures to illustrate. 
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organization’s management or subject matter expert. 

(TG//C I //H F)- Since it is possible that one communication event will be collected under multiple collection authorities (and multiple collection sources), not all 
of the results will be unique to one collection authority (or collection source). Keep in mind that the classification at the beginning of each result only 
indicates the highest level classification of that result, and does not necessarily reflect 



If a result was obt ained under multiple authorities (or sources), you will see more| 

I Here are examples of results originating from multiple collection sources. None of these results are considered BR- or PR/TT- 



|Comment [SLS10]: Note for audio recording, 
the acronym PDDG should be spelled out in letters 
“P D D G” followed by the word “SIGAD” — so this 
phrase will be recorded as “Producer Designator 
Digraph, or PDDG or SIGAD” 



Comment [all]: Screenshot 
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Next 



NEXT FRAME ID: 4100 



(U) (Insert image of OGC Attorney and HMC Character sitting at a table discussing the 
talking points below shown on a white board) 



BACK FRAME ID: 4080 



( TS//S I //NF ) BR- or PR/TT-“un/gue” query results are those contacts within a chain 
solely derived from the BR or PR/TT metadata and not duplicated in the results originating 
from any other authorities. 



ALT TAG: 



GRAPHIC/AV^^ 

(U) Look notes and match 

transcript to screen shots. 



(TS//S I //NF) (HMC Character): In the examples we just discussed, none of the results were unique to any one collection authority. Frequently, however, 
you’ll find that some of the results within the chain are unique to one particular collection authority. A BR- or PR/TT-unique query result is any piece of 
information that NSA would not have had but for the BR or PR/TT metadata from which it was drawn. In other words, BR or PR/TT was the ONLY source of 
that individual contact/query result. 



(TS//S I //NF) Here are some examples: example A is “E.O. 12333-unique,” while B is “PR/TT-unique,” and C is “BR-unique. 



( Comment [a!2]: Again show previous examples/^] 



(TS//S I //NF) Sharing restrictions in the FISC Orders only apply to unique BR or PR/TT query results. If query results are derived from multiple sources anc 
are not unique to BR and PR/TT alone, the rules governing the other collection authority would apply. We will discuss these sharing and handling 
restrictions in greater depth shortly. 



Comment [SLS13]: Note for audio recording: 
we will want some time in between saying example 
A is “E.O. 12333-unique,” and while B is 
“PR/TT-unique,” and and C is “BR-unique.” 
to allow learner to look at the examples. Please 
allow some “quiet” space that can be duplicated 
to the amount of time needed. THANKS! © 
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FRAME ID: 4100 


(TS//SI//NF) BR or PR/TT Query Results - Not Just a Line Within a Chain 
(TS//SI//NF) Examples of BR and/or PR/TT Query Results include: 

• A specific identifier 

• “Identifier A was in contact with Identifier B” 

• A .cml file (i.e. the entire contact chain/result set) that contains BR or PR/TT query 
results 

• A written or electronic depiction of a chain (i.e., the .cml file itself) or the analysis or 
partial analysis of a chain that includes BR or PR/TT results 

• A compilation or summary of first- and second-level contacts from a RAS-approved 
seed 

• A draft or a finished but not yet disseminated report 

• Any other BR or PR/TT information returned following a RAS-approved federated 
query 


NEXT FRAME ID: 4105 


BACK FRAME ID: 4090 


ALT TAG: 


GRAPHIC/AV: 
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( TS//S I //NF ) (OGC Attorney): Before we discuss sharing and handling restrictions of BR- and PR/TT-unique query results, itisimportant to understand that 
a BR or PR/TT query result is not just a line within the chain that is presented to you after you run a BR or PR/TT query in ^^^^|Any information that 
you derive, extract, or manipulate from that particular line in the chain becomes a BR or PR/TT result. Given that a source of the result is derived from BR 
or PR/TT metadata, any adaptation of that result, including information provided orally or in writing, even a tip or a lead, remains a BR or PR/TT query 
result. 

( TS//S I //NF ) (OGC Attorney): In addition, other examples of items that have been deemed to be BR and PR/TT query results include: 

• A specific identifier 

• “Identifier A was in contact with Identifier B" 

• A mfile (for example the entire contact chain/resuitset) that contains BR or PR/TT query results 

• A written or electronic depiction of a chain (like the ^|file itself) or the analysis or partial analysis of a chain that includes BR or PR/TT results 

• A compilation or summary of first- and second-level contacts of a RAS-approved seed 

• A draft or a finished but not yet disseminated report 

• Any other BR or PR/TT information returned following a RAS-approved federated query 



Comment [SLS14]: Note for audio recording, 
theSMEs would like for this to be pronounced “the 

|||||||J^'ile" - I know this might sound a little odd 

since we don’t say things like “the dot pdf file” but 
just trust me on this one because we had a 5 minute 
argument about it in a SME meeting. UGH! 
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(TS//SI//NF) (HMC Character): So, for exampl 
that depicts identifier A, the RAS-approved se 
that identifier A is communicating with identifie 

(TS//SI//NF) (FtMC Character): In addition, am 
belonged to Joe and identifier B belonged to £ 
writing that Joe talked to Sam, even if you dor 
PR/TT query result. 

(TS//SI//NF) (OGC Attorney): Remember, if th 
restrictions. 


e, if you run a BR or PR/TT query on a particular RAS-approved e-mail identifier and it returns information 
ed, was in direct contact with identifier B and the source of the metadata is BR or PR/TT, then just the fact 
r B is considered a BR or PR/TT query result. 

summary of that information would also be a BR or PR/TT query result. So, if you knew that identifier A 
iam, and the fact of that contact was derived from BR or PR/TT metadata, if you communicate orally or in 
't include the actual e-mail account or telephone numbers that were used to communicate, this is still a BR or 

ese results are determined to be BR- or PR/TT-UNIQUE, they are subiect to sharina and handling 
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( TS//SI//NF ) Sharing and Handling Restrictions of BR- or PR/TT-Unique Query 
Results 

( TS//SI//NF ) Examples of handling restrictions for BR and PR/TT unique query 
results: 

• Any document, .cml, or other file containing BR- or PR/TT-unique information may 
only be stored on the analyst’s personal folders, or an access-controlled, shared 
location 

• Query results canr^^^^^^^^|y system where the results would be shared with 
individuals without 

• BR- or PR/TT-unique results may not be quenedjnj] 
visible to other analysts (who may not have 
manipulated by behind the scenes analytics 



Is where 



user queries are 
or can be 



Comment [al5]: There is no such list of tools 
that are ok/ not ok to query, btw. 



(TS//SI//NF) These restrictions apply to information that is SOLELY unique to BR and 
PR/TT and do NOT apply to information which is NOT unique to BR or PR/TT! 



( TS//S I //NF ) (OGC Attorney): Remember, BR- or PR/TT-unique query results are those contacts within a chain solely derived from the BR or PR/TT 
metadata and not duplicated in the results originating from any other authorities. Any oral or written depiction, manipulation, or summary containing that 
information is also a unique query result. Until they are officially disseminated, BR- or PR/TT-unique results may only be shared with individuals who hold 
the proper credentials to receive or view BR or PR/TT information. The requirement is imposed because of the special handling restrictions that we will 
discuss later in this Module. Without the proper training, the FISC-imposed handling restrictions may not be followed. 



individuals who have the proper credentials to receive or view BR or PR/TT information. Remember, use 
means: 



determine a user's credentials. This 


Comment TSLS161: Note for audio recording. 




this is pronounced 







Any document, or other file containing BR- or PR/TT-unique information may only be stored on the analyst’s personal folders, or an access- f comment [SLS17]: Please say | 
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controlled, shared location that is accessible to only BR and PR/TT cleared personnel. 

• Query results cannot be put into any system where the results would be shared with individuals without 

• BR- or PR/TT -unique results may not be queried in tools where user queries are visible to other analysts (who may not have^^^^^^^^^H or 
can be manipulated by behind the scenes analytics. If you have questions regarding which tools are acceptable to further researc^Jue^^suits, 
please contact your management or technical director. 

( TS//S I //NF ) (SV Character) However, as we’ve discussed, not all BR or PR/TT results are unique. If a query result indicates it was derived from another 
collection source in addition to BR or PR/TT, the rules governing the other collection authority would apply to the handling and sharing of that query result. 
For example, this result came from both BR and E.O. 12333 collection; therefore, because it is not unique to BR information, it would be ok to inform non- 
BR cleared individuals of the fact of this communication, as well as task, query, and report this information according to standard E.O. 12333 guidelines. 

( TS//S I //NF ) (SV Character) In summary, if a query result has multiple collection authorities, analysts should source and/or report the non-BR or PR/TT 
version of that query result according to the rules governing the other authority. But if it is unique to either the BR or PR/TT authority then it is a unique 
query result with all of the applicable BR and PR/TT restrictions placed on it. In both cases, however, analysts should not share the actual chain containing 
BR or PR/TT results with analysts who do not have the credentials to receive or view B^^RAT information. In such an instance, if it is necessary to 
share the chain, analysts should re-run the query in the non-BR or non-PR/TT areas of ^^^^B un I sha re that .cml. 




TOP SECRET//SI//NOFORN 
Page 22 of 39 





TOP SECRET//SI//NOFORN 



DATE/PREPARER: 1 1/23/2010 SLS 


Topic 

(U) Retention of Metadata 
and Query Results 


Page Classification 
TOP SECRET//COMINT//NOFORN 


Screen Number 
16 of 27 




Home 


Exit 1 Glossary 


Back Next 


FRAME ID: 4120 


(U) Retention of Metadata and Query Results 




NEXT FRAME ID: 4130 


(TS//SI//NF) NSA must destroy BR and PR/TT metadata no later than five years (60 
months) after initial collection 


BACK FRAME ID: 4110 


(TS//SI//NF) The FISC has not imposed any destruction requirement on BR or PR/TT 


ALT TAG: 


query results 






GRAPHIC/AV: 

(U) Image of OGC Attorney, FIMC 
Character, and SV Character sitting at a 
table 

(TS//SI//NF) Possible cutaway images may 
include: 

• image depicting notional storage of 
bulk metadata and U.S. person 
information and then the 
destruction/deletion of the 
metadata 

• image depicting the retention of BR 
and PR/TT query results 









( TS//S I //NF ) (OGC Attorney): The Court Orders mandate destruction of the metadata five years or 60 months after initial collection. NSA destroys the BR 
and PR/TT metadata no later than five years after collection. There are no exceptions to this requirement when it comes to the bulk metadata. 



( TS//S I //NF ) (HMC Character): The destruction requirement applies to the bulk metadata; it does not apply to query results that have been generated as a 
result of queries of RAS-approved identifiers. Once we have queried the metadata we have selected metadata, or query results, and the 60-month cutoff 
does not apply. 
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3. ( TS//S I //NF ) Please complete the following sentence. The Emphatic Access Restriction (EAR) 

a) create^i^utomatic auditable record to allowforoversighttf authorities. 

b) alerts ^^^^^|when an individual without ^^^^^M^^^^Hattempts to conduct a 
query. 

c) forwards the query request to the HMC for approval. 

d) prohibits non-RAS-approved identifiers from being queried in 

e) None of the above. 

4. ( TS//S I //NF ) Assuming that the following answers describ^niqu^B^oi^R^T query results, which of the 
following could be shared with co-workers who do not have^^fgmmm 

a) Having a fellow analyst review the draft of a report that contains PR/TT-derived information 

b) A summary of direct or indirectcontactsofaRAS-approved identifiei^^^^^^^^^ 

your manager that ^^^^^^^^^^^^|contacted as 

noted in the PR/TT query you recently performed 

d) E-mailing an electronic depiction of a BR or PR/TT contact chain or a pattern 

e) None of the above. 




5. (TS//S I //NF) TRUE or FALSE: If a query result indicates that the source of information is both Executive 
Order 12333 collection and PR/TT collection, then the analyst must handle the E.O. 12333 result according 
to the PR/TT rules. 

a) True 

b) False 

(U) (HMC Character): Let’s make a few notes in our travel journal and check to see what you remember from this topic! 
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ANSWERS: 

Question 3. ( TS//S I //NF ) Correct! The EAR prohibits non-RAS-approved identifiers from being queried 

( TS//S I //NF ) Incorrect. The correct answer is d). The EAR prohibits non-RAS-approved identifiers from being queried in^^^^^^ 

Question 4. ( TS//S I //NF ) Correct! None of the examples listed should be shared with anyone outside of ^^^^^^^Mchannels. 

( TS//S I //NF ) Incorrect. The correct answer is e). None of the examples listed should be shared with anyoneoutsideof^^^^^^^Mchannels. 

Question 5. ( TS//S I //NF ) Correct! If a PR/TT query result can also be sourced to Executive Order 12333, then the information is considered E.O. 12333 
collection and follows the E.O. 12333 processes and procedures. 

( TS//S I //NF ) Incorrect. If a PR/TT query result can also be sourced to Executive Order 12333, then the information is considered E.O. 12333 collection and 
follows the E.O. 12333 processes and procedures. 
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is your RAS-approved identifie r, and he e-mails 

I who then e-mails 



|who then e-mails 

| how many hops is 

identifier? Are you allowed to chain that far in the PR/TT mode of 




from your RAS-approved 



a) 4 hops, no, unless one of the contacts between^^^^^and RAS 

approved. 

b) 3 hops, no (unless one of the contacts between 
RAS approved). 

c) 4 hops, yes. 

d) 3 hops, no. 

e) 2 hops, yes. 



7. ( TS//S I //NF ) If Badguyl’s identifier is RAS-approved, and he calls Associatel, who then calls 
Unknownguy, who then calls Unknownguy2, how many hops i^nknownguy2 from your RAS-approved 
identifier? Are you allowed to chain that far in the BR mode of^Hjj^l 

a) 4 hops, no, unless one of the contacts between badguyl and unknownguy2 is RAS 
approved. 

b) 3 hops, yes (with management approval). 

c) 4 hops, yes. 

d) 3 hops, no. 

e) 2 hops, yes (with management approval). 



(No audio or transcript on this page) 
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ANSWERS: 

Question 6. ( TS//S I //NF ) Correct! The _ 
far unless one of the contacts between 
( TS//S I //NF ) Incorrect. The correct answer is 
permitted to chain this far unless one of the contacts' 




roved identifier. You would not be permitted to chain this 
]is RAS approved. 
hop^ron^h^RA^^oorovecndentifier. You would not be 

nd 



Question 7. ( TS//S I //NF ) Correct! The 3 hops from the RAS-approved identifier. You are permitted to chain this far with management 

approval. 

( TS//S I //NF ) Incorrect. The correct answer is b). The^^^^^^^Hs 3 hops from the RAS-approved identifier. You are permitted to chain this far with 
management approval. 
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( TS//S I //NF ) Dissemination of BR- and PR/TT-Derived Information 



NEXT FRAME ID: 4150 



( TS//S I //NF ) Dissemination of BR and PR/TT results is distributing information to external 
customers in any form to include oral or written form 
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( TS//S I //NF ) Topics covered: 

• Information of foreign intelligence value which contains only foreign person information 
that IS NOT unique to BR or PR/TT 

• Information on U.S. persons (minimized) or foreign target activity unique to BR or PR/TT 
metadata 

• Information on U.S. persons (unminimized) unique to BR or PR/TT 



• Sharing of information outside 
of NSA (perhaps with FBI or 
other customer) 



(TS//S I //NF) (OGC Attorney): Now let’s focus our attention on the dissemination of BR and PR/TT results. We define dissemination of BR and PR/TT 
results as distributing information to external customers in any form to include oral or written form. Let’s say you perform a BR or PR/TT query using a 
RAS-approved identifier, and the query returns good foreign intelligence information based on unique BR or PR/TT metadata that you would like to report 
to Intelligence Community customers. What should you do? In this topic we will discuss to what extent we can use standard processes and procedures for 
the dissemination of this information and to what extent we must use special processes and procedures for the dissemination of this special foreign 
intelligence information. Given the sensitive nature of this Program, you will not be surprised to hear that there are special rules that apply to the 
dissemination of this information. 
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(TS//SI//NF) Information Derived Exclusively from BR or PR/TT -Additional Requirements 

(TS//S I //NF) Standard reporting practices and policies (including sourcing requirements and 
procedures and USSID SP0018 minimization) apply to BR and PR/TT query results 



1 



(TS//S I //NF) Two additional, BR- and PR/TT-specific requirements: 



BACK FRAME ID: 4140 • 



ALT TAG: 
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(TS//S I //NF) (OGC Attorney): First of all, every disseminated report from NSA must include sourcing information so that we know where the information 

Comment [SLS18]: UPDATE 7/13/1 1 from the 
SMEs: Please record at USSID 18 (do not say SPEW 
or SPOW, just “USSID 1 8” 



came from, as well as follow all USSID SP0018 minimization requirements and procedures^ For BR- and PR/TT-derived information, the analyst or reports 
needs to make sure that the information included in that report is properly sourced to the appropriate BR or PR/TT authority. 



The Counterterrorism (CT) nexus requirement applies to BR- and PR/TT-derived 
unminimized U.S. person information, but does not apply to BR- or PR/TT-derived non- 
U.S. person information or BR- or PR/TT-derived minimized U.S. person information 
The dissemination tracking requirement applies to all BR- and PR/TT-derived 
information 



(TS//S I //NF) In addition, the Court Orders for both the BR and PR/TT authorities have imposed two unique, stringent requirements with respect to 
disseminating information from these authorities. The first is the Counterterrorism, or CT, nexus requirement, and the second is the dissemination tracking 
requirement. 
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information outside of NSA, one of the designated approval authorities must determine: 
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(a) that the U.S. person information is related to CT information, and 

(b) that the U.S. person information is necessary to understand the CT information 
or to assess its importance 



(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 

( TS//S I //NF ) Image to explain the CT Nexus 



(TS//S I //NF) (OGC Attorney): The CT nexus requirement applies only to U.S. person information. If you run a query and the information returned is all 
foreign person information, then the CT nexus requirement does not apply to this situation. However, if your query results include U.S. person information 
derived from BR or PR/TT and you want to disseminate that information to an external customer, such as the FBI, then this requirement must be met prior 
to dissemination, in any form. Traditionally, under USSID SP0018| , if there is a piece of unminimized U.S. person information that you would like to 
disseminate, one of the designated approval authorities (to be covered on the next screen) needs to determine that the information is necessary to 
understand the foreign intelligence in that particular intelligence report before the information can be released. For BR and PR/TT, the requirement is 
slightly different. 



Comment [SLS19]: UPDATE 7/13/1 1 from the 
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(TS//S I //NF) (OGC Attorney): With respect to the BR and PR/TT authorities, the unminimized U.S. person information not only has to relate to and be 
necessary to understand the foreign intelligence information in the report, but it has to relate to and be necessary to understand the Counterterrorism 
information. 
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(TS//S I //NF) (HMC Character): Recall the RAS process and how you derived this information. The identifier you used to generate this information was 
approved based upon the RAS standard. It was found to be an identifier reasonably believed to be used by someone I 



(TS//S I //NF) (FIMC Character): It might seem as though the information would most certainly be counterterrorism-related since, due to the RAS approval 
process, you wouldn't have this U.S. person information from a query of BR or PR/TT if it weren’t related to counterterrorism. In the majority of cases, it will 
be counterterrorism-related; however, the nature of the counterterrorism target is that it often overlaps with several other areas that include 
counternarcotics, counterintelligence, money laundering, document forging, people and weapons trafficking, and other topics that are not CT-centric. Thus, 
due to the fact that these authorities provide NSA access to a high volume of U.S. person information for counterterrorism purposes, the Court Order 
requires an explicit finding that the information is in fact related to counterterrorism prior to dissemination. Therefore, one of the approved decision makers 
must document the finding using the proper terminology. It must state that the information is related to counterterrorism and that it is necessary to 
understand the counterterrorism information. 



(TS//S I //NF) (OGC Attorney): While the USSID SP0018 process is the most familiar method of governing the dissemination of unminimized U.S. person 
information obtained from traditional SIGINT means, the CT nexus requirement is an additional protection for U.S. person information being disseminated 
when the BR or PR/TT authorities, and metadata obtained by virtue of those authorities, is the source of the information. The FISC wants to ensure that the 
authorities are being used for counterterrorism purposes as intended, so consider the CT nexus requirement a step above justifying a foreign intelligence 
requirement. 
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• (U //FOUO ) The Chief and Deputy Chief of Information Sharing Services 

• (U //FOUO ) The Senior Operations Officers (SOOs) of the National Security 
Operations Center (NSOC) 

• (U //FOUO ) The Director and Deputy Director of the Signals Intelligence Directorate 

• (U //FOUO ) The Director and Deputy Director of NSA 



(U) This approval authority cannot be delegated to anyone else! 



(T S//S I //NF ) (OGC Attorney): Certain positions are authorized to validate the CT nexus requirement, as we just discussed, and approve the dissemination 
of U.S. person(s) information that we obtain from these two authorities. 



( TS//S I //NF ) (OGC Attorney): Recall from your USSID SP0018 training, there are certain positions at NSA which have the authority to approve the 
dissemination of information that would identify a U.S. person either by name or by context. Those positions are listed in USSID SP0018 and include the 
Chief and Deputy Chief of the Information Sharing Services Office, the Senior Operations Officers (SOO) within the National Security Operations Center 
(NSOC), the Director and Deputy Director of the Signals Intelligence Directorate (SID), and in some cas es they include the Director and Deputy D irector o 
NSA. 

( TS//S I //NF ) (FIMC Character): The list of positions which can approve the dissemination of unminimized U.S. person information derived from unique BR 
and PR/TT query results is the same as those named in USSID SP0018. 



Cc 

thi 

“n 


>mment [SLS20]: Note for audio recording, 
s is pronounced as a word “SOO” (rhymes with 
ew”, but does not rhyme with “sew a dress”) 
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( TS//S I //NF ) (OGC Attorney): It is important to note that the authority to approve the dissemination of U.S. person information cannot be delegated. This 
responsibility is assigned only to the positions named in the BR and PR/TT Court Orders. Let’s say, for example, that the Chief and Deputy Chief of 
Information Sharing Services Office, the two individuals who on a normal daily basis would be making the decision, are both on vacation on the same day. 
in this instance, someone else within their office may be the acting chief on that day; however, the acting chief cannot make the decision to disseminate 
U.S. person information. 

( TS//S I //NF ) (FiMC Character): Under these circumstances, if information about a U.S. person must be disseminated on that day, then you should send 
your dissemination request to one of the other positions named in the Orders. This would logically be the NSOC SOO. 

( TS//S I //NF ) (OGC Attorney): With respect to non-U. S. person information, standard NSA practices and policies (such as proper sourcing information) 

apply- 
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( TS//S I //NF ) (OGC Attorney): The other requirement, which applies to both U.S. person information as well as foreign person information, is the 
dissemination tracking requirement regarding the dissemination of BR- and PR/TT-derived information. The Orders require NSA to track and report to the 
FISC every instance in which NSA disseminates any information derived from either of these two authorities. 



( TS//S I //NF ) (HMC Character): This refers to information disseminated in a formal report as well as information disseminated informally such as written or 
oral collaboration with the FBI. We need to count every instance in which we take a piece of information derived from either of these two authorities and 
disseminate it outside of NSA. 



( TS//S I //NF ) (HMC Character): Normally an NSA product report is the record of a formal dissemination. In the context of the BR and PR/TT Programs, an 
official RFI response or Analyst Collaboration Record will also be viewed as dissemination. Because this FISC requirement goes beyond the more standard 
NSA procedures, additional diligence must be given to this requirement. NSA is required to report disseminations formal or informal to the FISC every 30 
days. 
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(U) Possible cutaway images may include: 



( TS//S I //NF ) Once approved for dissemination, BR- or PR/TT-derived information can be 
used within NSA for any lawful purpose, and the sharing restrictions no longer apply 



• Image that portrays the lifting of the 
sharing restriction once information 

is approved for dissemination 

( TS//S I //NF ) (OGC Attorney): Once BR and PR/TT information has been disseminated (such as in a product report, RFI, or briefing), generally speaking, 
there are no follow-on restrictions that either NSA or our customers need to follow regarding the sharing or dissemination of that information contained in 
the report. The Orders do not impose any restrictions on the use of formally reported information from the BR or PR/TT authorities; therefore, this 
information can be used for any lawful purpose. 



( TS//S I //NF ) If BR- or PR/TT-derived information is disseminated outside of NSA, then the restriction^mnternal sharing of that same information at NSA 
no longer apply. For ex^^^^^^^^^^^^^^^^sseminated can be shared outside of ^^^^^^^^channels, and the identifiers can be used in 
other tools as the 
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(U) Knowledge Check 3 

8. (TS//SI//NF) Identify the additional reauirements reqardina the dissemination of unminimized U.S. Derson 
information derived from BR or PR/TT information: 

a. The Counterterrorism nexus check 

b. The Counterintelligence nexus check 

c. The dissemination tracking requirement 

d. The sourcing requirement 

e. Both a) and c) 

9. (TS//SI//NF) TRUE or FALSE: the dissemination tracking requirement applies to only U.S. person BR- or 
PR/TT-derived information. 

a. TRUE 

b. FALSE 


NEXT FRAME ID: 4210 


BACK FRAME ID: 4190 


ALT TAG: 


GRAPHIC/AV: 


(U) (OGC Attorney): Before we move on to th 


e next part of our trip, let’s make a few notes in our travel journal. 


ANSWERS: 

Question 8. (TS//SI//NF) Correct! The Court Orders for both the BR and PR/TT authorities have imposed two unique requirements with respect to 
disseminating information from these authorities. The first is the Counterterrorism, or CT, nexus check (which applies only to U.S. person information), and 
the second is the dissemination tracking requirement. 

(TS//SI//NF) Incorrect, the correct answer is e). The Court Orders for both the BR and PR/TT authorities have imposed two unique requirements with 
respect to disseminating information from these authorities. The first is the Counterterrorism, or CT, nexus check (which applies only to U.S. person 
information), and the second is the dissemination tracking requirement. 

Question 9. (TS//SI//NF) Correct! The dissemination tracking requirement applies to both U.S. person and non-U. S. person BR- and PR/TT-derived 
information. 

(TS//SI//NF) Incorrect. The dissemination tracking requirement applies to both U.S. person and non-U. S. person BR- and PR/TT-derived information. 
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10. (TS//SI//NF) For the purpose of the BR and PR/TT Proqrams refers to the distribution of 

information to customers in anv form. is the provision of BR and PR/TT FISA query results with 


NEXT FRAME ID: 4220 


others inside of NSA authorized to receive BR and PR/TT query results. 

a) Dissemination, Distribution 

b) Sharing, Dissemination 

c) Dissemination, Sharing 


BACK FRAME ID: 4200 


d) Sharing, Distributing 


ALT TAG: 


1 1 . (TS//SI//NF) Which one of the following NSA positions does not have the authority to approve the 
dissemination of BR- or PR/TT-derived unminimized U.S. person information? 

a) The SOOs in the NSOC 

b) The Director and Deputy Director of the Signals Intelligence Directorate 

c) The Director and Deputy Director of NSA 

d) The Office of General Counsel (OGC) 

e) The Chief and Deputy Chief of Information Sharing Services 


GRAPHIC/AV: 


(No audio or transcript on this page) 




ANSWERS: 

Question 10. (TS//SI//NF) Correct! Dissemination is the more formal distribution of information to customers in either oral or written form. Sharing is the 
provision of BR and PR/TT FISA query results with others inside of NSA authorized to receive BR and PR/TT query results. 

(TS//SI//NF) Incorrect. The correct answer is c) Dissemination is the more formal distribution of information to external customers in either oral or written 
form. Sharing is the provision of BR and PR/TT FISA query results with others inside of NSA authorized to receive BR and PR/TT query results. 


Question 1 1 . (TS//S1//NF) Correct! The answer is d) The OGC does not have the authority to approve the dissemination of BR- or PR/TT-derived unminized 
U.S. person information. 

(TS//SI//NF) Incorrect. The answer is d) The OGC does not have the authority to approve the dissemination of BR- or PR/TT-derived unminized U.S. 
person information. 
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(U) Now that we have completed this part of your trip you should be able to: 

• (TS//SI//NF) Distinguish between the analysts authorized to query BR and PR/TT 
metadata and those authorized to view query results 

• (TS//SI//NF) Recognize the contact chaining restrictions for RAS-approved 
identifiers 

• (TS//SI//NF) Recognize what constitutes unique BR and PR/TT query results 

• (TS//SI//NF) Identify limitations that impact access, sharing, dissemination and 
retention of BR and PR/TT query results 

• (TS//SI//NF) Recognize the BR and PR/TT dissemination tracking requirement and 
the additional CT nexus requirement for U.S. person identifiers 
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(TS//SI//NF) (OGC Attorney): Remember, yoi 
you must be mindful of the special restriction: 

(U) (OGC Attorney): Now that we have comp 

• (TS//SI//NF) Distinguish between the 

• (TS//SI//NF) Recognize the contact c 

• (TS//SI//NF) Recognize what constitu 

• (TS//SI//NF) Identify limitations that ir 

• (TS//SI//NF) Recognize the BR and F 


are responsible for ensuring that the recipient of query results is authorized to receive these results. Also, 
for dissemination, either oral or written, of the BR- and PR/TT-derived information. 

eted this part of the trip you should be able to: 

analysts authorized to query BR and PR/TT metadata and those authorized to view query results 
haining restrictions for RAS-approved identifiers 
tes unique BR and PR/TT query results 

npact access, sharing, dissemination, and retention of BR and PR/TT query results 

R/TT dissemination tracking requirement and the additional CT nexus requirement for U.S. person identifiers 
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Foreign Person 
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“John Doe” 
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